CVE-2026-53383
published 2026-07-19CVE-2026-53383: In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.69%
49.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
reaches ksmbd_ipc_tree_connect_request(), which dereferences
user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.
Reject any non-first compound operation that lands on a session which is
not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 5.15.121 < 5.15.211 | 5.15.211 |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < d2bbbb6c55812220fee5d801c275cc267ea3cbeb | d2bbbb6c55812220fee5d801c275cc267ea3cbeb |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < 8f0302fb691537d33ec8f668565257ea9d340ffe | 8f0302fb691537d33ec8f668565257ea9d340ffe |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < 7cad3ceaf679c55bc9946685dacafce78ce6b51a | 7cad3ceaf679c55bc9946685dacafce78ce6b51a |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 | 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 | 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 |
| linux | linux | >= 5005bcb4219156f1bf7587b185080ec1da08518e < 609ca17d869d04ba249e32cdcbf13c0b1c66f43c | 609ca17d869d04ba249e32cdcbf13c0b1c66f43c |
| linux | linux | >= 6.1.36 < 6.1.177 | 6.1.177 |
| linux | linux | >= 6.3.10 < 6.4 | 6.4 |
| linux | linux | >= 854156d12caa9d36de1cf5f084591c7686cc8a9d < fc578523a72cb8b329d32070b95898e81613cc3f | fc578523a72cb8b329d32070b95898e81613cc3f |
| linux | linux | >= eb947403518ea3d93f6d89264bb1f5416bb0c7d0 < 25ff12b82a376ff5c4583102a63d2456a6b9ebb9 | 25ff12b82a376ff5c4583102a63d2456a6b9ebb9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.15.121 < 5.15.211 | 5.15.211 |
| linux | linux_kernel | >= 6.1.36 < 6.1.177 | 6.1.177 |
| linux | linux_kernel | >= 6.13 < 6.18.37 | 6.18.37 |
| linux | linux_kernel | >= 6.19 < 7.0.14 | 7.0.14 |
| linux | linux_kernel | >= 6.3.10 < 6.4 | 6.4 |
| linux | linux_kernel | >= 6.4.1 < 6.6.144 | 6.6.144 |
| linux | linux_kernel | >= 6.7 < 6.12.95 | 6.12.95 |
| linux | linux_kernel | >= 7.1 < 7.1.2 | 7.1.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.1.1 Ksmbd transport_ipc.c ksmbd_ipc_tree_connect_request User null pointer dereference (Nessus ID 330014)
vuldb·2026-07-27·CVSS 7.5
CVE-2026-53383 [HIGH] Linux Kernel up to 7.1.1 Ksmbd transport_ipc.c ksmbd_ipc_tree_connect_request User null pointer dereference (Nessus ID 330014)
A vulnerability described as critical has been identified in Linux Kernel up to 7.1.1. The impacted element is the function ksmbd_ipc_tree_connect_request of the file transport_ipc.c of the component Ksmbd. The manipulation of the argument User results in null pointer dereference.
This vulnerability is reported as CVE-2026-53383. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is no
ghsa_unreviewed·2026-07-19
CVE-2026-53383 [HIGH] In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is no
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS s
Red Hat
kernel: ksmbd: reject non-VALID session in compound request branch
vendor_redhat·2026-07-19·CVSS 7.5
CVE-2026-53383 [HIGH] CWE-476 kernel: ksmbd: reject non-VALID session in compound request branch
kernel: ksmbd: reject non-VALID session in compound request branch
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION_SETUP carrying only an NTLM Type-1
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43chttps://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51ahttps://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffehttps://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbebhttps://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f
2026-07-19
Published